In this demonstration,
we're going to look at fine‑grained Password Policy and Active
Directory Domain Services. We'll look at the Protected Users group in
Azure AD Password Protection. You're looking at the desktop of a
Windows Server 2022 domain controller.
And I'm just going to start right in here. We'll go into
Active Directory Users and Computers.
And if we come down to Users container,
we've got the Protected Users global group.
As you can see, it's a global security group.
The description is that members of this group are afforded additional
protections, and then there's a link to learn more about that.
So again, the idea is that your high value groups, as long as they're for humans,
remember,
we don't want to apply no delegation, no Kerberos extended ticket durations
and that kind of stuff, we don't want to put those restrictions on our group
managed service accounts or computer accounts.
This would just be for interactive high privilege user and
group identities. It's as simple as that.
So, we've got that group. It's just a fast way to efficiently improve the
security posture of those high value groups and users.
Okay,
let me minimize Users and Computers, and let's go to Group
Policy Management. And here I just want to quickly review.
We'll go to Default Domain Policy.
I showed you this in the previous lesson, and again,
you've probably done this in industry 100 times, at least I hope so.
We go under Computer Configuration, Policies, Windows Settings.
We've got our Security Settings where this is our main source
of control for server and client level system security. In
particular, we've got our Password Policy, our Account Lockout
Policy, our Kerberos Policy.
And then under Local Policies, we have our User Policy,
User Rights Assignment, and Security Options.
And as I had mentioned, in terms of domain password policy,
that's normally where that would live, in the Default
Domain Policy Group Policy object.
However,
what if we have groups that have different security
requirements in terms of passwords?
Let me actually go back to Users and Computers for a moment.
Let's see.
I've got an organizational unit called Staff, and I have a
security group called Accounting. Who's in there? Looks like
there's nobody in there yet.
Let me add in my Pat Colleague user, just so there's somebody in there.
And let's say that this group, maybe because they're dealing with financials,
we want them to have different password properties than the rest of the domain.
This would be a good use case for fine‑grained
password policy. Now, unfortunately,
fine‑grained password policy is one of those things
that requires a special tool.
We can't do that within ADUC, Active Directory Users and Computers.
So as you can see, I have Active Directory Administrative
Center all loaded up and ready to go.
The way we create fine‑grained password policy is by defining password
containers, and we can do that here in ADAC, Active Directory Administrative
Center, by navigating into our domain, coming down to the System Container,
and then down to Password Settings Container.
And then I'm going to right‑click within that window
and go to New, Password Settings.
And let's maximize this window.
I'm going to call this Accounting‑Group‑PW‑Settings.
And like I said before,
there's precedence values here that if it turns out there's more than
one associated password settings object for a group, the one with the
highest precedence would take effect.
And I'm not going to adjust any of these settings.
I just want to review with you.
We've got our traditional Group Policy‑based controls. Minimum
password length, complexity requirements,
reversible encryption, just your traditional stuff there.
And notice that for convenience we can optionally layer
in Account Lockout Policy as well.
So that's really about it.
It's pretty basic stuff.
And then lastly directly applies to, let's click Add, and here what I want
you to see in the filter is we've got Groups and Users.
Of course, it makes the most sense to do Group. So I'm going to do a search in my Active Directory domain for accounting.